• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * hostapd / WPS integration
3  * Copyright (c) 2008-2016, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "utils/uuid.h"
14 #include "common/wpa_ctrl.h"
15 #include "common/ieee802_11_defs.h"
16 #include "common/ieee802_11_common.h"
17 #include "eapol_auth/eapol_auth_sm.h"
18 #include "eapol_auth/eapol_auth_sm_i.h"
19 #include "wps/wps.h"
20 #include "wps/wps_defs.h"
21 #include "wps/wps_dev_attr.h"
22 #include "wps/wps_attr_parse.h"
23 #include "hostapd.h"
24 #include "ap_config.h"
25 #include "ap_drv_ops.h"
26 #include "beacon.h"
27 #include "sta_info.h"
28 #include "wps_hostapd.h"
29 
30 
31 #ifdef CONFIG_WPS_UPNP
32 #include "wps/wps_upnp.h"
33 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
34 				 struct wps_context *wps);
35 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd);
36 #endif /* CONFIG_WPS_UPNP */
37 
38 static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da,
39 				    const u8 *bssid,
40 				    const u8 *ie, size_t ie_len,
41 				    int ssi_signal);
42 static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx);
43 static void hostapd_wps_nfc_clear(struct wps_context *wps);
44 
45 
46 struct wps_for_each_data {
47 	int (*func)(struct hostapd_data *h, void *ctx);
48 	void *ctx;
49 	struct hostapd_data *calling_hapd;
50 };
51 
52 
wps_for_each(struct hostapd_iface * iface,void * ctx)53 static int wps_for_each(struct hostapd_iface *iface, void *ctx)
54 {
55 	struct wps_for_each_data *data = ctx;
56 	size_t j;
57 
58 	if (iface == NULL)
59 		return 0;
60 	for (j = 0; j < iface->num_bss; j++) {
61 		struct hostapd_data *hapd = iface->bss[j];
62 		int ret;
63 
64 		if (hapd != data->calling_hapd &&
65 		    (hapd->conf->wps_independent ||
66 		     data->calling_hapd->conf->wps_independent))
67 			continue;
68 
69 		ret = data->func(hapd, data->ctx);
70 		if (ret)
71 			return ret;
72 	}
73 
74 	return 0;
75 }
76 
77 
hostapd_wps_for_each(struct hostapd_data * hapd,int (* func)(struct hostapd_data * h,void * ctx),void * ctx)78 static int hostapd_wps_for_each(struct hostapd_data *hapd,
79 				int (*func)(struct hostapd_data *h, void *ctx),
80 				void *ctx)
81 {
82 	struct hostapd_iface *iface = hapd->iface;
83 	struct wps_for_each_data data;
84 	data.func = func;
85 	data.ctx = ctx;
86 	data.calling_hapd = hapd;
87 	if (iface->interfaces == NULL ||
88 	    iface->interfaces->for_each_interface == NULL)
89 		return wps_for_each(iface, &data);
90 	return iface->interfaces->for_each_interface(iface->interfaces,
91 						     wps_for_each, &data);
92 }
93 
94 
hostapd_wps_new_psk_cb(void * ctx,const u8 * mac_addr,const u8 * p2p_dev_addr,const u8 * psk,size_t psk_len)95 static int hostapd_wps_new_psk_cb(void *ctx, const u8 *mac_addr,
96 				  const u8 *p2p_dev_addr, const u8 *psk,
97 				  size_t psk_len)
98 {
99 	struct hostapd_data *hapd = ctx;
100 	struct hostapd_wpa_psk *p;
101 	struct hostapd_ssid *ssid = &hapd->conf->ssid;
102 
103 	if (is_zero_ether_addr(p2p_dev_addr)) {
104 		wpa_printf(MSG_DEBUG,
105 			   "Received new WPA/WPA2-PSK from WPS for STA " MACSTR,
106 			   MAC2STR(mac_addr));
107 	} else {
108 		wpa_printf(MSG_DEBUG,
109 			   "Received new WPA/WPA2-PSK from WPS for STA " MACSTR
110 			   " P2P Device Addr " MACSTR,
111 			   MAC2STR(mac_addr), MAC2STR(p2p_dev_addr));
112 	}
113 	wpa_hexdump_key(MSG_DEBUG, "Per-device PSK", psk, psk_len);
114 
115 	if (psk_len != PMK_LEN) {
116 		wpa_printf(MSG_DEBUG, "Unexpected PSK length %lu",
117 			   (unsigned long) psk_len);
118 		return -1;
119 	}
120 
121 	/* Add the new PSK to runtime PSK list */
122 	p = os_zalloc(sizeof(*p));
123 	if (p == NULL)
124 		return -1;
125 	os_memcpy(p->addr, mac_addr, ETH_ALEN);
126 	os_memcpy(p->p2p_dev_addr, p2p_dev_addr, ETH_ALEN);
127 	os_memcpy(p->psk, psk, PMK_LEN);
128 
129 	if (hapd->new_psk_cb) {
130 		hapd->new_psk_cb(hapd->new_psk_cb_ctx, mac_addr, p2p_dev_addr,
131 				 psk, psk_len);
132 	}
133 
134 	p->next = ssid->wpa_psk;
135 	ssid->wpa_psk = p;
136 
137 	if (ssid->wpa_psk_file) {
138 		FILE *f;
139 		char hex[PMK_LEN * 2 + 1];
140 		/* Add the new PSK to PSK list file */
141 		f = fopen(ssid->wpa_psk_file, "a");
142 		if (f == NULL) {
143 			wpa_printf(MSG_DEBUG, "Failed to add the PSK to "
144 				   "'%s'", ssid->wpa_psk_file);
145 			return -1;
146 		}
147 
148 		wpa_snprintf_hex(hex, sizeof(hex), psk, psk_len);
149 		fprintf(f, MACSTR " %s\n", MAC2STR(mac_addr), hex);
150 		fclose(f);
151 	}
152 
153 	return 0;
154 }
155 
156 
hostapd_wps_set_ie_cb(void * ctx,struct wpabuf * beacon_ie,struct wpabuf * probe_resp_ie)157 static int hostapd_wps_set_ie_cb(void *ctx, struct wpabuf *beacon_ie,
158 				 struct wpabuf *probe_resp_ie)
159 {
160 	struct hostapd_data *hapd = ctx;
161 	wpabuf_free(hapd->wps_beacon_ie);
162 	hapd->wps_beacon_ie = beacon_ie;
163 	wpabuf_free(hapd->wps_probe_resp_ie);
164 	hapd->wps_probe_resp_ie = probe_resp_ie;
165 	if (hapd->beacon_set_done)
166 		ieee802_11_set_beacon(hapd);
167 	return hostapd_set_ap_wps_ie(hapd);
168 }
169 
170 
hostapd_wps_pin_needed_cb(void * ctx,const u8 * uuid_e,const struct wps_device_data * dev)171 static void hostapd_wps_pin_needed_cb(void *ctx, const u8 *uuid_e,
172 				      const struct wps_device_data *dev)
173 {
174 	struct hostapd_data *hapd = ctx;
175 	char uuid[40], txt[400];
176 	int len;
177 	char devtype[WPS_DEV_TYPE_BUFSIZE];
178 	if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
179 		return;
180 	wpa_printf(MSG_DEBUG, "WPS: PIN needed for E-UUID %s", uuid);
181 	len = os_snprintf(txt, sizeof(txt), WPS_EVENT_PIN_NEEDED
182 			  "%s " MACSTR " [%s|%s|%s|%s|%s|%s]",
183 			  uuid, MAC2STR(dev->mac_addr), dev->device_name,
184 			  dev->manufacturer, dev->model_name,
185 			  dev->model_number, dev->serial_number,
186 			  wps_dev_type_bin2str(dev->pri_dev_type, devtype,
187 					       sizeof(devtype)));
188 	if (!os_snprintf_error(sizeof(txt), len))
189 		wpa_msg(hapd->msg_ctx, MSG_INFO, "%s", txt);
190 
191 	if (hapd->conf->wps_pin_requests) {
192 		FILE *f;
193 		struct os_time t;
194 		f = fopen(hapd->conf->wps_pin_requests, "a");
195 		if (f == NULL)
196 			return;
197 		os_get_time(&t);
198 		fprintf(f, "%ld\t%s\t" MACSTR "\t%s\t%s\t%s\t%s\t%s"
199 			"\t%s\n",
200 			t.sec, uuid, MAC2STR(dev->mac_addr), dev->device_name,
201 			dev->manufacturer, dev->model_name, dev->model_number,
202 			dev->serial_number,
203 			wps_dev_type_bin2str(dev->pri_dev_type, devtype,
204 					     sizeof(devtype)));
205 		fclose(f);
206 	}
207 }
208 
209 
210 struct wps_stop_reg_data {
211 	struct hostapd_data *current_hapd;
212 	const u8 *uuid_e;
213 	const u8 *dev_pw;
214 	size_t dev_pw_len;
215 };
216 
wps_stop_registrar(struct hostapd_data * hapd,void * ctx)217 static int wps_stop_registrar(struct hostapd_data *hapd, void *ctx)
218 {
219 	struct wps_stop_reg_data *data = ctx;
220 	if (hapd != data->current_hapd && hapd->wps != NULL)
221 		wps_registrar_complete(hapd->wps->registrar, data->uuid_e,
222 				       data->dev_pw, data->dev_pw_len);
223 	return 0;
224 }
225 
226 
hostapd_wps_reg_success_cb(void * ctx,const u8 * mac_addr,const u8 * uuid_e,const u8 * dev_pw,size_t dev_pw_len)227 static void hostapd_wps_reg_success_cb(void *ctx, const u8 *mac_addr,
228 				       const u8 *uuid_e, const u8 *dev_pw,
229 				       size_t dev_pw_len)
230 {
231 	struct hostapd_data *hapd = ctx;
232 	char uuid[40];
233 	struct wps_stop_reg_data data;
234 	if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
235 		return;
236 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_REG_SUCCESS MACSTR " %s",
237 		MAC2STR(mac_addr), uuid);
238 	if (hapd->wps_reg_success_cb)
239 		hapd->wps_reg_success_cb(hapd->wps_reg_success_cb_ctx,
240 					 mac_addr, uuid_e);
241 	data.current_hapd = hapd;
242 	data.uuid_e = uuid_e;
243 	data.dev_pw = dev_pw;
244 	data.dev_pw_len = dev_pw_len;
245 	hostapd_wps_for_each(hapd, wps_stop_registrar, &data);
246 }
247 
248 
hostapd_wps_enrollee_seen_cb(void * ctx,const u8 * addr,const u8 * uuid_e,const u8 * pri_dev_type,u16 config_methods,u16 dev_password_id,u8 request_type,const char * dev_name)249 static void hostapd_wps_enrollee_seen_cb(void *ctx, const u8 *addr,
250 					 const u8 *uuid_e,
251 					 const u8 *pri_dev_type,
252 					 u16 config_methods,
253 					 u16 dev_password_id, u8 request_type,
254 					 const char *dev_name)
255 {
256 	struct hostapd_data *hapd = ctx;
257 	char uuid[40];
258 	char devtype[WPS_DEV_TYPE_BUFSIZE];
259 	if (uuid_bin2str(uuid_e, uuid, sizeof(uuid)))
260 		return;
261 	if (dev_name == NULL)
262 		dev_name = "";
263 	wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ENROLLEE_SEEN MACSTR
264 		     " %s %s 0x%x %u %u [%s]",
265 		     MAC2STR(addr), uuid,
266 		     wps_dev_type_bin2str(pri_dev_type, devtype,
267 					  sizeof(devtype)),
268 		     config_methods, dev_password_id, request_type, dev_name);
269 }
270 
271 
wps_reload_config(void * eloop_data,void * user_ctx)272 static void wps_reload_config(void *eloop_data, void *user_ctx)
273 {
274 	struct hostapd_iface *iface = eloop_data;
275 
276 	wpa_printf(MSG_DEBUG, "WPS: Reload configuration data");
277 	if (iface->interfaces == NULL ||
278 	    iface->interfaces->reload_config(iface) < 0) {
279 		wpa_printf(MSG_WARNING, "WPS: Failed to reload the updated "
280 			   "configuration");
281 	}
282 }
283 
284 
hostapd_wps_eap_completed(struct hostapd_data * hapd)285 void hostapd_wps_eap_completed(struct hostapd_data *hapd)
286 {
287 	/*
288 	 * Reduce race condition of the station trying to reconnect immediately
289 	 * after AP reconfiguration through WPS by rescheduling the reload
290 	 * timeout to happen after EAP completion rather than the originally
291 	 * scheduled 100 ms after new configuration became known.
292 	 */
293 	if (eloop_deplete_timeout(0, 0, wps_reload_config, hapd->iface, NULL) ==
294 	    1)
295 		wpa_printf(MSG_DEBUG, "WPS: Reschedule immediate configuration reload");
296 }
297 
298 
hapd_new_ap_event(struct hostapd_data * hapd,const u8 * attr,size_t attr_len)299 static void hapd_new_ap_event(struct hostapd_data *hapd, const u8 *attr,
300 			      size_t attr_len)
301 {
302 	size_t blen = attr_len * 2 + 1;
303 	char *buf = os_malloc(blen);
304 	if (buf) {
305 		wpa_snprintf_hex(buf, blen, attr, attr_len);
306 		wpa_msg(hapd->msg_ctx, MSG_INFO,
307 			WPS_EVENT_NEW_AP_SETTINGS "%s", buf);
308 		os_free(buf);
309 	}
310 }
311 
312 
hapd_wps_reconfig_in_memory(struct hostapd_data * hapd,const struct wps_credential * cred)313 static int hapd_wps_reconfig_in_memory(struct hostapd_data *hapd,
314 				       const struct wps_credential *cred)
315 {
316 	struct hostapd_bss_config *bss = hapd->conf;
317 
318 	wpa_printf(MSG_DEBUG, "WPS: Updating in-memory configuration");
319 
320 	bss->wps_state = 2;
321 	if (cred->ssid_len <= SSID_MAX_LEN) {
322 		os_memcpy(bss->ssid.ssid, cred->ssid, cred->ssid_len);
323 		bss->ssid.ssid_len = cred->ssid_len;
324 		bss->ssid.ssid_set = 1;
325 	}
326 
327 	if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
328 	    (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
329 		bss->wpa = 3;
330 	else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
331 		bss->wpa = 2;
332 	else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
333 		bss->wpa = 1;
334 	else
335 		bss->wpa = 0;
336 
337 	if (bss->wpa) {
338 		if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA))
339 			bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X;
340 		if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK))
341 			bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
342 
343 		bss->wpa_pairwise = 0;
344 		if (cred->encr_type & WPS_ENCR_AES) {
345 			if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
346 				bss->wpa_pairwise |= WPA_CIPHER_GCMP;
347 			else
348 				bss->wpa_pairwise |= WPA_CIPHER_CCMP;
349 		}
350 		if (cred->encr_type & WPS_ENCR_TKIP)
351 			bss->wpa_pairwise |= WPA_CIPHER_TKIP;
352 		bss->rsn_pairwise = bss->wpa_pairwise;
353 		bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa,
354 							    bss->wpa_pairwise,
355 							    bss->rsn_pairwise);
356 
357 		if (hapd->conf->wps_cred_add_sae &&
358 		    (cred->auth_type & WPS_AUTH_WPA2PSK) &&
359 		    cred->key_len != 2 * PMK_LEN) {
360 			bss->wpa_key_mgmt |= WPA_KEY_MGMT_SAE;
361 #ifdef CONFIG_IEEE80211W
362 			if (bss->ieee80211w == NO_MGMT_FRAME_PROTECTION)
363 				bss->ieee80211w =
364 					MGMT_FRAME_PROTECTION_OPTIONAL;
365 			bss->sae_require_mfp = 1;
366 #endif /* CONFIG_IEEE80211W */
367 		}
368 
369 		if (cred->key_len >= 8 && cred->key_len < 64) {
370 			os_free(bss->ssid.wpa_passphrase);
371 			bss->ssid.wpa_passphrase = os_zalloc(cred->key_len + 1);
372 			if (bss->ssid.wpa_passphrase)
373 				os_memcpy(bss->ssid.wpa_passphrase, cred->key,
374 					  cred->key_len);
375 			hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk);
376 		} else if (cred->key_len == 64) {
377 			hostapd_config_clear_wpa_psk(&bss->ssid.wpa_psk);
378 			bss->ssid.wpa_psk =
379 				os_zalloc(sizeof(struct hostapd_wpa_psk));
380 			if (bss->ssid.wpa_psk &&
381 			    hexstr2bin((const char *) cred->key,
382 				       bss->ssid.wpa_psk->psk, PMK_LEN) == 0) {
383 				bss->ssid.wpa_psk->group = 1;
384 				os_free(bss->ssid.wpa_passphrase);
385 				bss->ssid.wpa_passphrase = NULL;
386 			}
387 		}
388 		bss->auth_algs = 1;
389 	} else {
390 		/*
391 		 * WPS 2.0 does not allow WEP to be configured, so no need to
392 		 * process that option here either.
393 		 */
394 		bss->auth_algs = 1;
395 	}
396 
397 	/* Schedule configuration reload after short period of time to allow
398 	 * EAP-WSC to be finished.
399 	 */
400 	eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
401 			       NULL);
402 
403 	return 0;
404 }
405 
406 
hapd_wps_cred_cb(struct hostapd_data * hapd,void * ctx)407 static int hapd_wps_cred_cb(struct hostapd_data *hapd, void *ctx)
408 {
409 	const struct wps_credential *cred = ctx;
410 	FILE *oconf, *nconf;
411 	size_t len, i;
412 	char *tmp_fname;
413 	char buf[1024];
414 	int multi_bss;
415 	int wpa;
416 	int pmf_changed = 0;
417 
418 	if (hapd->wps == NULL)
419 		return 0;
420 
421 	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
422 			cred->cred_attr, cred->cred_attr_len);
423 
424 	wpa_printf(MSG_DEBUG, "WPS: Received new AP Settings");
425 	wpa_hexdump_ascii(MSG_DEBUG, "WPS: SSID", cred->ssid, cred->ssid_len);
426 	wpa_printf(MSG_DEBUG, "WPS: Authentication Type 0x%x",
427 		   cred->auth_type);
428 	wpa_printf(MSG_DEBUG, "WPS: Encryption Type 0x%x", cred->encr_type);
429 	wpa_printf(MSG_DEBUG, "WPS: Network Key Index %d", cred->key_idx);
430 	wpa_hexdump_key(MSG_DEBUG, "WPS: Network Key",
431 			cred->key, cred->key_len);
432 	wpa_printf(MSG_DEBUG, "WPS: MAC Address " MACSTR,
433 		   MAC2STR(cred->mac_addr));
434 
435 	if ((hapd->conf->wps_cred_processing == 1 ||
436 	     hapd->conf->wps_cred_processing == 2) && cred->cred_attr) {
437 		hapd_new_ap_event(hapd, cred->cred_attr, cred->cred_attr_len);
438 	} else if (hapd->conf->wps_cred_processing == 1 ||
439 		   hapd->conf->wps_cred_processing == 2) {
440 		struct wpabuf *attr;
441 		attr = wpabuf_alloc(200);
442 		if (attr && wps_build_credential_wrap(attr, cred) == 0)
443 			hapd_new_ap_event(hapd, wpabuf_head_u8(attr),
444 					  wpabuf_len(attr));
445 		wpabuf_free(attr);
446 	} else
447 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_NEW_AP_SETTINGS);
448 
449 	if (hapd->conf->wps_cred_processing == 1)
450 		return 0;
451 
452 	os_memcpy(hapd->wps->ssid, cred->ssid, cred->ssid_len);
453 	hapd->wps->ssid_len = cred->ssid_len;
454 	hapd->wps->encr_types = cred->encr_type;
455 	hapd->wps->encr_types_rsn = cred->encr_type;
456 	hapd->wps->encr_types_wpa = cred->encr_type;
457 	hapd->wps->auth_types = cred->auth_type;
458 	hapd->wps->ap_encr_type = cred->encr_type;
459 	hapd->wps->ap_auth_type = cred->auth_type;
460 	if (cred->key_len == 0) {
461 		os_free(hapd->wps->network_key);
462 		hapd->wps->network_key = NULL;
463 		hapd->wps->network_key_len = 0;
464 	} else if ((cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) &&
465 		   (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN)) {
466 		wpa_printf(MSG_INFO, "WPS: Invalid key length %lu for WPA/WPA2",
467 			   (unsigned long) cred->key_len);
468 		return -1;
469 	} else {
470 		if (hapd->wps->network_key == NULL ||
471 		    hapd->wps->network_key_len < cred->key_len) {
472 			hapd->wps->network_key_len = 0;
473 			os_free(hapd->wps->network_key);
474 			hapd->wps->network_key = os_malloc(cred->key_len);
475 			if (hapd->wps->network_key == NULL)
476 				return -1;
477 		}
478 		hapd->wps->network_key_len = cred->key_len;
479 		os_memcpy(hapd->wps->network_key, cred->key, cred->key_len);
480 	}
481 	hapd->wps->wps_state = WPS_STATE_CONFIGURED;
482 
483 	if (hapd->iface->config_fname == NULL)
484 		return hapd_wps_reconfig_in_memory(hapd, cred);
485 	len = os_strlen(hapd->iface->config_fname) + 5;
486 	tmp_fname = os_malloc(len);
487 	if (tmp_fname == NULL)
488 		return -1;
489 	os_snprintf(tmp_fname, len, "%s-new", hapd->iface->config_fname);
490 
491 	oconf = fopen(hapd->iface->config_fname, "r");
492 	if (oconf == NULL) {
493 		wpa_printf(MSG_WARNING, "WPS: Could not open current "
494 			   "configuration file");
495 		os_free(tmp_fname);
496 		return -1;
497 	}
498 
499 	nconf = fopen(tmp_fname, "w");
500 	if (nconf == NULL) {
501 		wpa_printf(MSG_WARNING, "WPS: Could not write updated "
502 			   "configuration file");
503 		os_free(tmp_fname);
504 		fclose(oconf);
505 		return -1;
506 	}
507 
508 	fprintf(nconf, "# WPS configuration - START\n");
509 
510 	fprintf(nconf, "wps_state=2\n");
511 
512 	if (is_hex(cred->ssid, cred->ssid_len)) {
513 		fprintf(nconf, "ssid2=");
514 		for (i = 0; i < cred->ssid_len; i++)
515 			fprintf(nconf, "%02x", cred->ssid[i]);
516 		fprintf(nconf, "\n");
517 	} else {
518 		fprintf(nconf, "ssid=");
519 		for (i = 0; i < cred->ssid_len; i++)
520 			fputc(cred->ssid[i], nconf);
521 		fprintf(nconf, "\n");
522 	}
523 
524 	if ((cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK)) &&
525 	    (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK)))
526 		wpa = 3;
527 	else if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA2PSK))
528 		wpa = 2;
529 	else if (cred->auth_type & (WPS_AUTH_WPA | WPS_AUTH_WPAPSK))
530 		wpa = 1;
531 	else
532 		wpa = 0;
533 
534 	if (wpa) {
535 		char *prefix;
536 #ifdef CONFIG_IEEE80211W
537 		int sae = 0;
538 #endif /* CONFIG_IEEE80211W */
539 
540 		fprintf(nconf, "wpa=%d\n", wpa);
541 
542 		fprintf(nconf, "wpa_key_mgmt=");
543 		prefix = "";
544 		if (cred->auth_type & (WPS_AUTH_WPA2 | WPS_AUTH_WPA)) {
545 			fprintf(nconf, "WPA-EAP");
546 			prefix = " ";
547 		}
548 		if (cred->auth_type & (WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK)) {
549 			fprintf(nconf, "%sWPA-PSK", prefix);
550 			prefix = " ";
551 		}
552 		if (hapd->conf->wps_cred_add_sae &&
553 		    (cred->auth_type & WPS_AUTH_WPA2PSK) &&
554 		    cred->key_len != 2 * PMK_LEN) {
555 			fprintf(nconf, "%sSAE", prefix);
556 #ifdef CONFIG_IEEE80211W
557 			sae = 1;
558 #endif /* CONFIG_IEEE80211W */
559 		}
560 		fprintf(nconf, "\n");
561 
562 #ifdef CONFIG_IEEE80211W
563 		if (sae && hapd->conf->ieee80211w == NO_MGMT_FRAME_PROTECTION) {
564 			fprintf(nconf, "ieee80211w=%d\n",
565 				MGMT_FRAME_PROTECTION_OPTIONAL);
566 			pmf_changed = 1;
567 		}
568 		if (sae)
569 			fprintf(nconf, "sae_require_mfp=1\n");
570 #endif /* CONFIG_IEEE80211W */
571 
572 		fprintf(nconf, "wpa_pairwise=");
573 		prefix = "";
574 		if (cred->encr_type & WPS_ENCR_AES) {
575 			if (hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
576 				fprintf(nconf, "GCMP");
577 			else
578 				fprintf(nconf, "CCMP");
579 
580 			prefix = " ";
581 		}
582 		if (cred->encr_type & WPS_ENCR_TKIP) {
583 			fprintf(nconf, "%sTKIP", prefix);
584 		}
585 		fprintf(nconf, "\n");
586 
587 		if (cred->key_len >= 8 && cred->key_len < 64) {
588 			fprintf(nconf, "wpa_passphrase=");
589 			for (i = 0; i < cred->key_len; i++)
590 				fputc(cred->key[i], nconf);
591 			fprintf(nconf, "\n");
592 		} else if (cred->key_len == 64) {
593 			fprintf(nconf, "wpa_psk=");
594 			for (i = 0; i < cred->key_len; i++)
595 				fputc(cred->key[i], nconf);
596 			fprintf(nconf, "\n");
597 		} else {
598 			wpa_printf(MSG_WARNING, "WPS: Invalid key length %lu "
599 				   "for WPA/WPA2",
600 				   (unsigned long) cred->key_len);
601 		}
602 
603 		fprintf(nconf, "auth_algs=1\n");
604 	} else {
605 		/*
606 		 * WPS 2.0 does not allow WEP to be configured, so no need to
607 		 * process that option here either.
608 		 */
609 		fprintf(nconf, "auth_algs=1\n");
610 	}
611 
612 	fprintf(nconf, "# WPS configuration - END\n");
613 
614 	multi_bss = 0;
615 	while (fgets(buf, sizeof(buf), oconf)) {
616 		if (os_strncmp(buf, "bss=", 4) == 0)
617 			multi_bss = 1;
618 		if (!multi_bss &&
619 		    (str_starts(buf, "ssid=") ||
620 		     str_starts(buf, "ssid2=") ||
621 		     str_starts(buf, "auth_algs=") ||
622 		     str_starts(buf, "wep_default_key=") ||
623 		     str_starts(buf, "wep_key") ||
624 		     str_starts(buf, "wps_state=") ||
625 		     (pmf_changed && str_starts(buf, "ieee80211w=")) ||
626 		     str_starts(buf, "wpa=") ||
627 		     str_starts(buf, "wpa_psk=") ||
628 		     str_starts(buf, "wpa_pairwise=") ||
629 		     str_starts(buf, "rsn_pairwise=") ||
630 		     str_starts(buf, "wpa_key_mgmt=") ||
631 		     str_starts(buf, "wpa_passphrase="))) {
632 			fprintf(nconf, "#WPS# %s", buf);
633 		} else
634 			fprintf(nconf, "%s", buf);
635 	}
636 
637 	fclose(nconf);
638 	fclose(oconf);
639 
640 	if (rename(tmp_fname, hapd->iface->config_fname) < 0) {
641 		wpa_printf(MSG_WARNING, "WPS: Failed to rename the updated "
642 			   "configuration file: %s", strerror(errno));
643 		os_free(tmp_fname);
644 		return -1;
645 	}
646 
647 	os_free(tmp_fname);
648 
649 	/* Schedule configuration reload after short period of time to allow
650 	 * EAP-WSC to be finished.
651 	 */
652 	eloop_register_timeout(0, 100000, wps_reload_config, hapd->iface,
653 			       NULL);
654 
655 	wpa_printf(MSG_DEBUG, "WPS: AP configuration updated");
656 
657 	return 0;
658 }
659 
660 
hostapd_wps_cred_cb(void * ctx,const struct wps_credential * cred)661 static int hostapd_wps_cred_cb(void *ctx, const struct wps_credential *cred)
662 {
663 	struct hostapd_data *hapd = ctx;
664 	return hostapd_wps_for_each(hapd, hapd_wps_cred_cb, (void *) cred);
665 }
666 
667 
hostapd_wps_reenable_ap_pin(void * eloop_data,void * user_ctx)668 static void hostapd_wps_reenable_ap_pin(void *eloop_data, void *user_ctx)
669 {
670 	struct hostapd_data *hapd = eloop_data;
671 
672 	if (hapd->conf->ap_setup_locked)
673 		return;
674 	if (hapd->ap_pin_failures_consecutive >= 10)
675 		return;
676 
677 	wpa_printf(MSG_DEBUG, "WPS: Re-enable AP PIN");
678 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED);
679 	hapd->wps->ap_setup_locked = 0;
680 	wps_registrar_update_ie(hapd->wps->registrar);
681 }
682 
683 
wps_pwd_auth_fail(struct hostapd_data * hapd,void * ctx)684 static int wps_pwd_auth_fail(struct hostapd_data *hapd, void *ctx)
685 {
686 	struct wps_event_pwd_auth_fail *data = ctx;
687 
688 	if (!data->enrollee || hapd->conf->ap_pin == NULL || hapd->wps == NULL)
689 		return 0;
690 
691 	/*
692 	 * Registrar failed to prove its knowledge of the AP PIN. Lock AP setup
693 	 * for some time if this happens multiple times to slow down brute
694 	 * force attacks.
695 	 */
696 	hapd->ap_pin_failures++;
697 	hapd->ap_pin_failures_consecutive++;
698 	wpa_printf(MSG_DEBUG, "WPS: AP PIN authentication failure number %u "
699 		   "(%u consecutive)",
700 		   hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive);
701 	if (hapd->ap_pin_failures < 3)
702 		return 0;
703 
704 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_LOCKED);
705 	hapd->wps->ap_setup_locked = 1;
706 
707 	wps_registrar_update_ie(hapd->wps->registrar);
708 
709 	if (!hapd->conf->ap_setup_locked &&
710 	    hapd->ap_pin_failures_consecutive >= 10) {
711 		/*
712 		 * In indefinite lockdown - disable automatic AP PIN
713 		 * reenablement.
714 		 */
715 		eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
716 		wpa_printf(MSG_DEBUG, "WPS: AP PIN disabled indefinitely");
717 	} else if (!hapd->conf->ap_setup_locked) {
718 		if (hapd->ap_pin_lockout_time == 0)
719 			hapd->ap_pin_lockout_time = 60;
720 		else if (hapd->ap_pin_lockout_time < 365 * 24 * 60 * 60 &&
721 			 (hapd->ap_pin_failures % 3) == 0)
722 			hapd->ap_pin_lockout_time *= 2;
723 
724 		wpa_printf(MSG_DEBUG, "WPS: Disable AP PIN for %u seconds",
725 			   hapd->ap_pin_lockout_time);
726 		eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
727 		eloop_register_timeout(hapd->ap_pin_lockout_time, 0,
728 				       hostapd_wps_reenable_ap_pin, hapd,
729 				       NULL);
730 	}
731 
732 	return 0;
733 }
734 
735 
hostapd_pwd_auth_fail(struct hostapd_data * hapd,struct wps_event_pwd_auth_fail * data)736 static void hostapd_pwd_auth_fail(struct hostapd_data *hapd,
737 				  struct wps_event_pwd_auth_fail *data)
738 {
739 	/* Update WPS Status - Authentication Failure */
740 	wpa_printf(MSG_DEBUG, "WPS: Authentication failure update");
741 	hapd->wps_stats.status = WPS_STATUS_FAILURE;
742 	hapd->wps_stats.failure_reason = WPS_EI_AUTH_FAILURE;
743 	os_memcpy(hapd->wps_stats.peer_addr, data->peer_macaddr, ETH_ALEN);
744 
745 	hostapd_wps_for_each(hapd, wps_pwd_auth_fail, data);
746 }
747 
748 
wps_ap_pin_success(struct hostapd_data * hapd,void * ctx)749 static int wps_ap_pin_success(struct hostapd_data *hapd, void *ctx)
750 {
751 	if (hapd->conf->ap_pin == NULL || hapd->wps == NULL)
752 		return 0;
753 
754 	if (hapd->ap_pin_failures_consecutive == 0)
755 		return 0;
756 
757 	wpa_printf(MSG_DEBUG, "WPS: Clear consecutive AP PIN failure counter "
758 		   "- total validation failures %u (%u consecutive)",
759 		   hapd->ap_pin_failures, hapd->ap_pin_failures_consecutive);
760 	hapd->ap_pin_failures_consecutive = 0;
761 
762 	return 0;
763 }
764 
765 
hostapd_wps_ap_pin_success(struct hostapd_data * hapd)766 static void hostapd_wps_ap_pin_success(struct hostapd_data *hapd)
767 {
768 	hostapd_wps_for_each(hapd, wps_ap_pin_success, NULL);
769 }
770 
771 
hostapd_wps_event_pbc_overlap(struct hostapd_data * hapd)772 static void hostapd_wps_event_pbc_overlap(struct hostapd_data *hapd)
773 {
774 	/* Update WPS Status - PBC Overlap */
775 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_OVERLAP;
776 }
777 
778 
hostapd_wps_event_pbc_timeout(struct hostapd_data * hapd)779 static void hostapd_wps_event_pbc_timeout(struct hostapd_data *hapd)
780 {
781 	/* Update WPS PBC Status:PBC Timeout */
782 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_TIMEOUT;
783 }
784 
785 
hostapd_wps_event_pbc_active(struct hostapd_data * hapd)786 static void hostapd_wps_event_pbc_active(struct hostapd_data *hapd)
787 {
788 	/* Update WPS PBC status - Active */
789 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_ACTIVE;
790 }
791 
792 
hostapd_wps_event_pbc_disable(struct hostapd_data * hapd)793 static void hostapd_wps_event_pbc_disable(struct hostapd_data *hapd)
794 {
795 	/* Update WPS PBC status - Active */
796 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE;
797 }
798 
799 
hostapd_wps_event_success(struct hostapd_data * hapd,struct wps_event_success * success)800 static void hostapd_wps_event_success(struct hostapd_data *hapd,
801 				      struct wps_event_success *success)
802 {
803 	/* Update WPS status - Success */
804 	hapd->wps_stats.pbc_status = WPS_PBC_STATUS_DISABLE;
805 	hapd->wps_stats.status = WPS_STATUS_SUCCESS;
806 	os_memcpy(hapd->wps_stats.peer_addr, success->peer_macaddr, ETH_ALEN);
807 }
808 
809 
hostapd_wps_event_fail(struct hostapd_data * hapd,struct wps_event_fail * fail)810 static void hostapd_wps_event_fail(struct hostapd_data *hapd,
811 				   struct wps_event_fail *fail)
812 {
813 	/* Update WPS status - Failure */
814 	hapd->wps_stats.status = WPS_STATUS_FAILURE;
815 	os_memcpy(hapd->wps_stats.peer_addr, fail->peer_macaddr, ETH_ALEN);
816 
817 	hapd->wps_stats.failure_reason = fail->error_indication;
818 
819 	if (fail->error_indication > 0 &&
820 	    fail->error_indication < NUM_WPS_EI_VALUES) {
821 		wpa_msg(hapd->msg_ctx, MSG_INFO,
822 			WPS_EVENT_FAIL "msg=%d config_error=%d reason=%d (%s)",
823 			fail->msg, fail->config_error, fail->error_indication,
824 			wps_ei_str(fail->error_indication));
825 	} else {
826 		wpa_msg(hapd->msg_ctx, MSG_INFO,
827 			WPS_EVENT_FAIL "msg=%d config_error=%d",
828 			fail->msg, fail->config_error);
829 	}
830 }
831 
832 
hostapd_wps_event_cb(void * ctx,enum wps_event event,union wps_event_data * data)833 static void hostapd_wps_event_cb(void *ctx, enum wps_event event,
834 				 union wps_event_data *data)
835 {
836 	struct hostapd_data *hapd = ctx;
837 
838 	switch (event) {
839 	case WPS_EV_M2D:
840 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_M2D);
841 		break;
842 	case WPS_EV_FAIL:
843 		hostapd_wps_event_fail(hapd, &data->fail);
844 		break;
845 	case WPS_EV_SUCCESS:
846 		hostapd_wps_event_success(hapd, &data->success);
847 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_SUCCESS);
848 		break;
849 	case WPS_EV_PWD_AUTH_FAIL:
850 		hostapd_pwd_auth_fail(hapd, &data->pwd_auth_fail);
851 		break;
852 	case WPS_EV_PBC_OVERLAP:
853 		hostapd_wps_event_pbc_overlap(hapd);
854 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_OVERLAP);
855 		break;
856 	case WPS_EV_PBC_TIMEOUT:
857 		hostapd_wps_event_pbc_timeout(hapd);
858 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_TIMEOUT);
859 		break;
860 	case WPS_EV_PBC_ACTIVE:
861 		hostapd_wps_event_pbc_active(hapd);
862 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_ACTIVE);
863 		break;
864 	case WPS_EV_PBC_DISABLE:
865 		hostapd_wps_event_pbc_disable(hapd);
866 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_DISABLE);
867 		break;
868 	case WPS_EV_ER_AP_ADD:
869 		break;
870 	case WPS_EV_ER_AP_REMOVE:
871 		break;
872 	case WPS_EV_ER_ENROLLEE_ADD:
873 		break;
874 	case WPS_EV_ER_ENROLLEE_REMOVE:
875 		break;
876 	case WPS_EV_ER_AP_SETTINGS:
877 		break;
878 	case WPS_EV_ER_SET_SELECTED_REGISTRAR:
879 		break;
880 	case WPS_EV_AP_PIN_SUCCESS:
881 		hostapd_wps_ap_pin_success(hapd);
882 		break;
883 	}
884 	if (hapd->wps_event_cb)
885 		hapd->wps_event_cb(hapd->wps_event_cb_ctx, event, data);
886 }
887 
888 
hostapd_wps_rf_band_cb(void * ctx)889 static int hostapd_wps_rf_band_cb(void *ctx)
890 {
891 	struct hostapd_data *hapd = ctx;
892 
893 	return hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
894 		WPS_RF_50GHZ :
895 		hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ?
896 		WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
897 }
898 
899 
hostapd_wps_clear_ies(struct hostapd_data * hapd,int deinit_only)900 static void hostapd_wps_clear_ies(struct hostapd_data *hapd, int deinit_only)
901 {
902 	wpabuf_free(hapd->wps_beacon_ie);
903 	hapd->wps_beacon_ie = NULL;
904 
905 	wpabuf_free(hapd->wps_probe_resp_ie);
906 	hapd->wps_probe_resp_ie = NULL;
907 
908 	if (deinit_only) {
909 		if (hapd->drv_priv)
910 			hostapd_reset_ap_wps_ie(hapd);
911 		return;
912 	}
913 
914 	hostapd_set_ap_wps_ie(hapd);
915 }
916 
917 
get_uuid_cb(struct hostapd_iface * iface,void * ctx)918 static int get_uuid_cb(struct hostapd_iface *iface, void *ctx)
919 {
920 	const u8 **uuid = ctx;
921 	size_t j;
922 
923 	if (iface == NULL)
924 		return 0;
925 	for (j = 0; j < iface->num_bss; j++) {
926 		struct hostapd_data *hapd = iface->bss[j];
927 		if (hapd->wps && !hapd->conf->wps_independent &&
928 		    !is_nil_uuid(hapd->wps->uuid)) {
929 			*uuid = hapd->wps->uuid;
930 			return 1;
931 		}
932 	}
933 
934 	return 0;
935 }
936 
937 
get_own_uuid(struct hostapd_iface * iface)938 static const u8 * get_own_uuid(struct hostapd_iface *iface)
939 {
940 	const u8 *uuid;
941 	if (iface->interfaces == NULL ||
942 	    iface->interfaces->for_each_interface == NULL)
943 		return NULL;
944 	uuid = NULL;
945 	iface->interfaces->for_each_interface(iface->interfaces, get_uuid_cb,
946 					      &uuid);
947 	return uuid;
948 }
949 
950 
count_interface_cb(struct hostapd_iface * iface,void * ctx)951 static int count_interface_cb(struct hostapd_iface *iface, void *ctx)
952 {
953 	int *count= ctx;
954 	(*count)++;
955 	return 0;
956 }
957 
958 
interface_count(struct hostapd_iface * iface)959 static int interface_count(struct hostapd_iface *iface)
960 {
961 	int count = 0;
962 	if (iface->interfaces == NULL ||
963 	    iface->interfaces->for_each_interface == NULL)
964 		return 0;
965 	iface->interfaces->for_each_interface(iface->interfaces,
966 					      count_interface_cb, &count);
967 	return count;
968 }
969 
970 
hostapd_wps_set_vendor_ext(struct hostapd_data * hapd,struct wps_context * wps)971 static int hostapd_wps_set_vendor_ext(struct hostapd_data *hapd,
972 				      struct wps_context *wps)
973 {
974 	int i;
975 
976 	for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++) {
977 		wpabuf_free(wps->dev.vendor_ext[i]);
978 		wps->dev.vendor_ext[i] = NULL;
979 
980 		if (hapd->conf->wps_vendor_ext[i] == NULL)
981 			continue;
982 
983 		wps->dev.vendor_ext[i] =
984 			wpabuf_dup(hapd->conf->wps_vendor_ext[i]);
985 		if (wps->dev.vendor_ext[i] == NULL) {
986 			while (--i >= 0)
987 				wpabuf_free(wps->dev.vendor_ext[i]);
988 			return -1;
989 		}
990 	}
991 
992 	return 0;
993 }
994 
995 
hostapd_free_wps(struct wps_context * wps)996 static void hostapd_free_wps(struct wps_context *wps)
997 {
998 	int i;
999 
1000 	for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
1001 		wpabuf_free(wps->dev.vendor_ext[i]);
1002 	wps_device_data_free(&wps->dev);
1003 	os_free(wps->network_key);
1004 	hostapd_wps_nfc_clear(wps);
1005 	wpabuf_free(wps->dh_pubkey);
1006 	wpabuf_free(wps->dh_privkey);
1007 	os_free(wps);
1008 }
1009 
1010 
hostapd_init_wps(struct hostapd_data * hapd,struct hostapd_bss_config * conf)1011 int hostapd_init_wps(struct hostapd_data *hapd,
1012 		     struct hostapd_bss_config *conf)
1013 {
1014 	struct wps_context *wps;
1015 	struct wps_registrar_config cfg;
1016 	u8 *multi_ap_netw_key = NULL;
1017 
1018 	if (conf->wps_state == 0) {
1019 		hostapd_wps_clear_ies(hapd, 0);
1020 		return 0;
1021 	}
1022 
1023 	wps = os_zalloc(sizeof(*wps));
1024 	if (wps == NULL)
1025 		return -1;
1026 
1027 	wps->cred_cb = hostapd_wps_cred_cb;
1028 	wps->event_cb = hostapd_wps_event_cb;
1029 	wps->rf_band_cb = hostapd_wps_rf_band_cb;
1030 	wps->cb_ctx = hapd;
1031 
1032 	os_memset(&cfg, 0, sizeof(cfg));
1033 	wps->wps_state = hapd->conf->wps_state;
1034 	wps->ap_setup_locked = hapd->conf->ap_setup_locked;
1035 	if (is_nil_uuid(hapd->conf->uuid)) {
1036 		const u8 *uuid;
1037 		uuid = get_own_uuid(hapd->iface);
1038 		if (uuid && !conf->wps_independent) {
1039 			os_memcpy(wps->uuid, uuid, UUID_LEN);
1040 			wpa_hexdump(MSG_DEBUG, "WPS: Clone UUID from another "
1041 				    "interface", wps->uuid, UUID_LEN);
1042 		} else {
1043 			uuid_gen_mac_addr(hapd->own_addr, wps->uuid);
1044 			wpa_hexdump(MSG_DEBUG, "WPS: UUID based on MAC "
1045 				    "address", wps->uuid, UUID_LEN);
1046 		}
1047 	} else {
1048 		os_memcpy(wps->uuid, hapd->conf->uuid, UUID_LEN);
1049 		wpa_hexdump(MSG_DEBUG, "WPS: Use configured UUID",
1050 			    wps->uuid, UUID_LEN);
1051 	}
1052 	wps->ssid_len = hapd->conf->ssid.ssid_len;
1053 	os_memcpy(wps->ssid, hapd->conf->ssid.ssid, wps->ssid_len);
1054 	wps->ap = 1;
1055 	os_memcpy(wps->dev.mac_addr, hapd->own_addr, ETH_ALEN);
1056 	wps->dev.device_name = hapd->conf->device_name ?
1057 		os_strdup(hapd->conf->device_name) : NULL;
1058 	wps->dev.manufacturer = hapd->conf->manufacturer ?
1059 		os_strdup(hapd->conf->manufacturer) : NULL;
1060 	wps->dev.model_name = hapd->conf->model_name ?
1061 		os_strdup(hapd->conf->model_name) : NULL;
1062 	wps->dev.model_number = hapd->conf->model_number ?
1063 		os_strdup(hapd->conf->model_number) : NULL;
1064 	wps->dev.serial_number = hapd->conf->serial_number ?
1065 		os_strdup(hapd->conf->serial_number) : NULL;
1066 	wps->config_methods =
1067 		wps_config_methods_str2bin(hapd->conf->config_methods);
1068 	if ((wps->config_methods &
1069 	     (WPS_CONFIG_DISPLAY | WPS_CONFIG_VIRT_DISPLAY |
1070 	      WPS_CONFIG_PHY_DISPLAY)) == WPS_CONFIG_DISPLAY) {
1071 		wpa_printf(MSG_INFO, "WPS: Converting display to "
1072 			   "virtual_display for WPS 2.0 compliance");
1073 		wps->config_methods |= WPS_CONFIG_VIRT_DISPLAY;
1074 	}
1075 	if ((wps->config_methods &
1076 	     (WPS_CONFIG_PUSHBUTTON | WPS_CONFIG_VIRT_PUSHBUTTON |
1077 	      WPS_CONFIG_PHY_PUSHBUTTON)) == WPS_CONFIG_PUSHBUTTON) {
1078 		wpa_printf(MSG_INFO, "WPS: Converting push_button to "
1079 			   "virtual_push_button for WPS 2.0 compliance");
1080 		wps->config_methods |= WPS_CONFIG_VIRT_PUSHBUTTON;
1081 	}
1082 	os_memcpy(wps->dev.pri_dev_type, hapd->conf->device_type,
1083 		  WPS_DEV_TYPE_LEN);
1084 
1085 	if (hostapd_wps_set_vendor_ext(hapd, wps) < 0)
1086 		goto fail;
1087 
1088 	wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version);
1089 
1090 	if (conf->wps_rf_bands) {
1091 		wps->dev.rf_bands = conf->wps_rf_bands;
1092 	} else {
1093 		wps->dev.rf_bands =
1094 			hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211A ?
1095 			WPS_RF_50GHZ :
1096 			hapd->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD ?
1097 			WPS_RF_60GHZ : WPS_RF_24GHZ; /* FIX: dualband AP */
1098 	}
1099 
1100 	if (conf->wpa & WPA_PROTO_RSN) {
1101 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
1102 			wps->auth_types |= WPS_AUTH_WPA2PSK;
1103 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
1104 			wps->auth_types |= WPS_AUTH_WPA2;
1105 
1106 		if (conf->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1107 					  WPA_CIPHER_CCMP_256 |
1108 					  WPA_CIPHER_GCMP_256)) {
1109 			wps->encr_types |= WPS_ENCR_AES;
1110 			wps->encr_types_rsn |= WPS_ENCR_AES;
1111 		}
1112 		if (conf->rsn_pairwise & WPA_CIPHER_TKIP) {
1113 			wps->encr_types |= WPS_ENCR_TKIP;
1114 			wps->encr_types_rsn |= WPS_ENCR_TKIP;
1115 		}
1116 	}
1117 
1118 	if (conf->wpa & WPA_PROTO_WPA) {
1119 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_PSK)
1120 			wps->auth_types |= WPS_AUTH_WPAPSK;
1121 		if (conf->wpa_key_mgmt & WPA_KEY_MGMT_IEEE8021X)
1122 			wps->auth_types |= WPS_AUTH_WPA;
1123 
1124 		if (conf->wpa_pairwise & WPA_CIPHER_CCMP) {
1125 			wps->encr_types |= WPS_ENCR_AES;
1126 			wps->encr_types_wpa |= WPS_ENCR_AES;
1127 		}
1128 		if (conf->wpa_pairwise & WPA_CIPHER_TKIP) {
1129 			wps->encr_types |= WPS_ENCR_TKIP;
1130 			wps->encr_types_wpa |= WPS_ENCR_TKIP;
1131 		}
1132 	}
1133 
1134 	if (conf->ssid.security_policy == SECURITY_PLAINTEXT) {
1135 		wps->encr_types |= WPS_ENCR_NONE;
1136 		wps->auth_types |= WPS_AUTH_OPEN;
1137 	}
1138 
1139 	if (conf->ssid.wpa_psk_file) {
1140 		/* Use per-device PSKs */
1141 	} else if (conf->ssid.wpa_passphrase) {
1142 		wps->network_key = (u8 *) os_strdup(conf->ssid.wpa_passphrase);
1143 		wps->network_key_len = os_strlen(conf->ssid.wpa_passphrase);
1144 	} else if (conf->ssid.wpa_psk) {
1145 		wps->network_key = os_malloc(2 * PMK_LEN + 1);
1146 		if (wps->network_key == NULL)
1147 			goto fail;
1148 		wpa_snprintf_hex((char *) wps->network_key, 2 * PMK_LEN + 1,
1149 				 conf->ssid.wpa_psk->psk, PMK_LEN);
1150 		wps->network_key_len = 2 * PMK_LEN;
1151 	} else if (conf->ssid.wep.keys_set && conf->ssid.wep.key[0]) {
1152 		wps->network_key = os_malloc(conf->ssid.wep.len[0]);
1153 		if (wps->network_key == NULL)
1154 			goto fail;
1155 		os_memcpy(wps->network_key, conf->ssid.wep.key[0],
1156 			  conf->ssid.wep.len[0]);
1157 		wps->network_key_len = conf->ssid.wep.len[0];
1158 	}
1159 
1160 	if (conf->ssid.wpa_psk) {
1161 		os_memcpy(wps->psk, conf->ssid.wpa_psk->psk, PMK_LEN);
1162 		wps->psk_set = 1;
1163 	}
1164 
1165 	wps->ap_auth_type = wps->auth_types;
1166 	wps->ap_encr_type = wps->encr_types;
1167 	if (conf->wps_state == WPS_STATE_NOT_CONFIGURED) {
1168 		/* Override parameters to enable security by default */
1169 		wps->auth_types = WPS_AUTH_WPA2PSK | WPS_AUTH_WPAPSK;
1170 		wps->encr_types = WPS_ENCR_AES | WPS_ENCR_TKIP;
1171 		wps->encr_types_rsn = WPS_ENCR_AES | WPS_ENCR_TKIP;
1172 		wps->encr_types_wpa = WPS_ENCR_AES | WPS_ENCR_TKIP;
1173 	}
1174 
1175 	if ((hapd->conf->multi_ap & FRONTHAUL_BSS) &&
1176 	    hapd->conf->multi_ap_backhaul_ssid.ssid_len) {
1177 		cfg.multi_ap_backhaul_ssid_len =
1178 			hapd->conf->multi_ap_backhaul_ssid.ssid_len;
1179 		cfg.multi_ap_backhaul_ssid =
1180 			hapd->conf->multi_ap_backhaul_ssid.ssid;
1181 
1182 		if (conf->multi_ap_backhaul_ssid.wpa_passphrase) {
1183 			cfg.multi_ap_backhaul_network_key = (const u8 *)
1184 				conf->multi_ap_backhaul_ssid.wpa_passphrase;
1185 			cfg.multi_ap_backhaul_network_key_len =
1186 				os_strlen(conf->multi_ap_backhaul_ssid.wpa_passphrase);
1187 		} else if (conf->multi_ap_backhaul_ssid.wpa_psk) {
1188 			multi_ap_netw_key = os_malloc(2 * PMK_LEN + 1);
1189 			if (!multi_ap_netw_key)
1190 				goto fail;
1191 			wpa_snprintf_hex((char *) multi_ap_netw_key,
1192 					 2 * PMK_LEN + 1,
1193 					 conf->multi_ap_backhaul_ssid.wpa_psk->psk,
1194 					 PMK_LEN);
1195 			cfg.multi_ap_backhaul_network_key = multi_ap_netw_key;
1196 			cfg.multi_ap_backhaul_network_key_len = 2 * PMK_LEN;
1197 		}
1198 	}
1199 
1200 	wps->ap_settings = conf->ap_settings;
1201 	wps->ap_settings_len = conf->ap_settings_len;
1202 
1203 	cfg.new_psk_cb = hostapd_wps_new_psk_cb;
1204 	cfg.set_ie_cb = hostapd_wps_set_ie_cb;
1205 	cfg.pin_needed_cb = hostapd_wps_pin_needed_cb;
1206 	cfg.reg_success_cb = hostapd_wps_reg_success_cb;
1207 	cfg.enrollee_seen_cb = hostapd_wps_enrollee_seen_cb;
1208 	cfg.cb_ctx = hapd;
1209 	cfg.skip_cred_build = conf->skip_cred_build;
1210 	cfg.extra_cred = conf->extra_cred;
1211 	cfg.extra_cred_len = conf->extra_cred_len;
1212 	cfg.disable_auto_conf = (hapd->conf->wps_cred_processing == 1) &&
1213 		conf->skip_cred_build;
1214 	if (conf->ssid.security_policy == SECURITY_STATIC_WEP)
1215 		cfg.static_wep_only = 1;
1216 	cfg.dualband = interface_count(hapd->iface) > 1;
1217 	if ((wps->dev.rf_bands & (WPS_RF_50GHZ | WPS_RF_24GHZ)) ==
1218 	    (WPS_RF_50GHZ | WPS_RF_24GHZ))
1219 		cfg.dualband = 1;
1220 	if (cfg.dualband)
1221 		wpa_printf(MSG_DEBUG, "WPS: Dualband AP");
1222 	cfg.force_per_enrollee_psk = conf->force_per_enrollee_psk;
1223 
1224 	wps->registrar = wps_registrar_init(wps, &cfg);
1225 	if (wps->registrar == NULL) {
1226 		wpa_printf(MSG_ERROR, "Failed to initialize WPS Registrar");
1227 		goto fail;
1228 	}
1229 
1230 #ifdef CONFIG_WPS_UPNP
1231 	wps->friendly_name = hapd->conf->friendly_name;
1232 	wps->manufacturer_url = hapd->conf->manufacturer_url;
1233 	wps->model_description = hapd->conf->model_description;
1234 	wps->model_url = hapd->conf->model_url;
1235 	wps->upc = hapd->conf->upc;
1236 #endif /* CONFIG_WPS_UPNP */
1237 
1238 	hostapd_register_probereq_cb(hapd, hostapd_wps_probe_req_rx, hapd);
1239 
1240 	hapd->wps = wps;
1241 	bin_clear_free(multi_ap_netw_key, 2 * PMK_LEN);
1242 
1243 	return 0;
1244 
1245 fail:
1246 	bin_clear_free(multi_ap_netw_key, 2 * PMK_LEN);
1247 	hostapd_free_wps(wps);
1248 	return -1;
1249 }
1250 
1251 
hostapd_init_wps_complete(struct hostapd_data * hapd)1252 int hostapd_init_wps_complete(struct hostapd_data *hapd)
1253 {
1254 	struct wps_context *wps = hapd->wps;
1255 
1256 	if (wps == NULL)
1257 		return 0;
1258 
1259 #ifdef CONFIG_WPS_UPNP
1260 	if (hostapd_wps_upnp_init(hapd, wps) < 0) {
1261 		wpa_printf(MSG_ERROR, "Failed to initialize WPS UPnP");
1262 		wps_registrar_deinit(wps->registrar);
1263 		hostapd_free_wps(wps);
1264 		hapd->wps = NULL;
1265 		return -1;
1266 	}
1267 #endif /* CONFIG_WPS_UPNP */
1268 
1269 	return 0;
1270 }
1271 
1272 
hostapd_wps_nfc_clear(struct wps_context * wps)1273 static void hostapd_wps_nfc_clear(struct wps_context *wps)
1274 {
1275 #ifdef CONFIG_WPS_NFC
1276 	wpa_printf(MSG_DEBUG, "WPS: Clear NFC Tag context %p", wps);
1277 	wps->ap_nfc_dev_pw_id = 0;
1278 	wpabuf_free(wps->ap_nfc_dh_pubkey);
1279 	wps->ap_nfc_dh_pubkey = NULL;
1280 	wpabuf_free(wps->ap_nfc_dh_privkey);
1281 	wps->ap_nfc_dh_privkey = NULL;
1282 	wpabuf_free(wps->ap_nfc_dev_pw);
1283 	wps->ap_nfc_dev_pw = NULL;
1284 #endif /* CONFIG_WPS_NFC */
1285 }
1286 
1287 
hostapd_deinit_wps(struct hostapd_data * hapd)1288 void hostapd_deinit_wps(struct hostapd_data *hapd)
1289 {
1290 	eloop_cancel_timeout(hostapd_wps_reenable_ap_pin, hapd, NULL);
1291 	eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1292 	eloop_cancel_timeout(wps_reload_config, hapd->iface, NULL);
1293 	if (hapd->wps == NULL) {
1294 		hostapd_wps_clear_ies(hapd, 1);
1295 		return;
1296 	}
1297 #ifdef CONFIG_WPS_UPNP
1298 	hostapd_wps_upnp_deinit(hapd);
1299 #endif /* CONFIG_WPS_UPNP */
1300 	wps_registrar_deinit(hapd->wps->registrar);
1301 	wps_free_pending_msgs(hapd->wps->upnp_msgs);
1302 	hostapd_free_wps(hapd->wps);
1303 	hapd->wps = NULL;
1304 	hostapd_wps_clear_ies(hapd, 1);
1305 }
1306 
1307 
hostapd_update_wps(struct hostapd_data * hapd)1308 void hostapd_update_wps(struct hostapd_data *hapd)
1309 {
1310 	if (hapd->wps == NULL)
1311 		return;
1312 
1313 #ifdef CONFIG_WPS_UPNP
1314 	hapd->wps->friendly_name = hapd->conf->friendly_name;
1315 	hapd->wps->manufacturer_url = hapd->conf->manufacturer_url;
1316 	hapd->wps->model_description = hapd->conf->model_description;
1317 	hapd->wps->model_url = hapd->conf->model_url;
1318 	hapd->wps->upc = hapd->conf->upc;
1319 #endif /* CONFIG_WPS_UPNP */
1320 
1321 	hostapd_wps_set_vendor_ext(hapd, hapd->wps);
1322 
1323 	if (hapd->conf->wps_state)
1324 		wps_registrar_update_ie(hapd->wps->registrar);
1325 	else
1326 		hostapd_deinit_wps(hapd);
1327 }
1328 
1329 
1330 struct wps_add_pin_data {
1331 	const u8 *addr;
1332 	const u8 *uuid;
1333 	const u8 *pin;
1334 	size_t pin_len;
1335 	int timeout;
1336 	int added;
1337 };
1338 
1339 
wps_add_pin(struct hostapd_data * hapd,void * ctx)1340 static int wps_add_pin(struct hostapd_data *hapd, void *ctx)
1341 {
1342 	struct wps_add_pin_data *data = ctx;
1343 	int ret;
1344 
1345 	if (hapd->wps == NULL)
1346 		return 0;
1347 	ret = wps_registrar_add_pin(hapd->wps->registrar, data->addr,
1348 				    data->uuid, data->pin, data->pin_len,
1349 				    data->timeout);
1350 	if (ret == 0)
1351 		data->added++;
1352 	return ret;
1353 }
1354 
1355 
hostapd_wps_add_pin(struct hostapd_data * hapd,const u8 * addr,const char * uuid,const char * pin,int timeout)1356 int hostapd_wps_add_pin(struct hostapd_data *hapd, const u8 *addr,
1357 			const char *uuid, const char *pin, int timeout)
1358 {
1359 	u8 u[UUID_LEN];
1360 	struct wps_add_pin_data data;
1361 
1362 	data.addr = addr;
1363 	data.uuid = u;
1364 	data.pin = (const u8 *) pin;
1365 	data.pin_len = os_strlen(pin);
1366 	data.timeout = timeout;
1367 	data.added = 0;
1368 
1369 	if (os_strcmp(uuid, "any") == 0)
1370 		data.uuid = NULL;
1371 	else {
1372 		if (uuid_str2bin(uuid, u))
1373 			return -1;
1374 		data.uuid = u;
1375 	}
1376 	if (hostapd_wps_for_each(hapd, wps_add_pin, &data) < 0)
1377 		return -1;
1378 	return data.added ? 0 : -1;
1379 }
1380 
1381 
1382 struct wps_button_pushed_ctx {
1383 	const u8 *p2p_dev_addr;
1384 	unsigned int count;
1385 };
1386 
wps_button_pushed(struct hostapd_data * hapd,void * ctx)1387 static int wps_button_pushed(struct hostapd_data *hapd, void *ctx)
1388 {
1389 	struct wps_button_pushed_ctx *data = ctx;
1390 
1391 	if (hapd->wps) {
1392 		data->count++;
1393 		return wps_registrar_button_pushed(hapd->wps->registrar,
1394 						   data->p2p_dev_addr);
1395 	}
1396 
1397 	return 0;
1398 }
1399 
1400 
hostapd_wps_button_pushed(struct hostapd_data * hapd,const u8 * p2p_dev_addr)1401 int hostapd_wps_button_pushed(struct hostapd_data *hapd,
1402 			      const u8 *p2p_dev_addr)
1403 {
1404 	struct wps_button_pushed_ctx ctx;
1405 	int ret;
1406 
1407 	os_memset(&ctx, 0, sizeof(ctx));
1408 	ctx.p2p_dev_addr = p2p_dev_addr;
1409 	ret = hostapd_wps_for_each(hapd, wps_button_pushed, &ctx);
1410 	if (ret == 0 && !ctx.count)
1411 		ret = -1;
1412 	return ret;
1413 }
1414 
1415 
1416 struct wps_cancel_ctx {
1417 	unsigned int count;
1418 };
1419 
wps_cancel(struct hostapd_data * hapd,void * ctx)1420 static int wps_cancel(struct hostapd_data *hapd, void *ctx)
1421 {
1422 	struct wps_cancel_ctx *data = ctx;
1423 
1424 	if (hapd->wps) {
1425 		data->count++;
1426 		wps_registrar_wps_cancel(hapd->wps->registrar);
1427 		ap_for_each_sta(hapd, ap_sta_wps_cancel, NULL);
1428 	}
1429 
1430 	return 0;
1431 }
1432 
1433 
hostapd_wps_cancel(struct hostapd_data * hapd)1434 int hostapd_wps_cancel(struct hostapd_data *hapd)
1435 {
1436 	struct wps_cancel_ctx ctx;
1437 	int ret;
1438 
1439 	os_memset(&ctx, 0, sizeof(ctx));
1440 	ret = hostapd_wps_for_each(hapd, wps_cancel, &ctx);
1441 	if (ret == 0 && !ctx.count)
1442 		ret = -1;
1443 	return ret;
1444 }
1445 
1446 
hostapd_wps_probe_req_rx(void * ctx,const u8 * addr,const u8 * da,const u8 * bssid,const u8 * ie,size_t ie_len,int ssi_signal)1447 static int hostapd_wps_probe_req_rx(void *ctx, const u8 *addr, const u8 *da,
1448 				    const u8 *bssid,
1449 				    const u8 *ie, size_t ie_len,
1450 				    int ssi_signal)
1451 {
1452 	struct hostapd_data *hapd = ctx;
1453 	struct wpabuf *wps_ie;
1454 	struct ieee802_11_elems elems;
1455 
1456 	if (hapd->wps == NULL)
1457 		return 0;
1458 
1459 	if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) {
1460 		wpa_printf(MSG_DEBUG, "WPS: Could not parse ProbeReq from "
1461 			   MACSTR, MAC2STR(addr));
1462 		return 0;
1463 	}
1464 
1465 	if (elems.ssid && elems.ssid_len > 0 &&
1466 	    (elems.ssid_len != hapd->conf->ssid.ssid_len ||
1467 	     os_memcmp(elems.ssid, hapd->conf->ssid.ssid, elems.ssid_len) !=
1468 	     0))
1469 		return 0; /* Not for us */
1470 
1471 	wps_ie = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA);
1472 	if (wps_ie == NULL)
1473 		return 0;
1474 	if (wps_validate_probe_req(wps_ie, addr) < 0) {
1475 		wpabuf_free(wps_ie);
1476 		return 0;
1477 	}
1478 
1479 	if (wpabuf_len(wps_ie) > 0) {
1480 		int p2p_wildcard = 0;
1481 #ifdef CONFIG_P2P
1482 		if (elems.ssid && elems.ssid_len == P2P_WILDCARD_SSID_LEN &&
1483 		    os_memcmp(elems.ssid, P2P_WILDCARD_SSID,
1484 			      P2P_WILDCARD_SSID_LEN) == 0)
1485 			p2p_wildcard = 1;
1486 #endif /* CONFIG_P2P */
1487 		wps_registrar_probe_req_rx(hapd->wps->registrar, addr, wps_ie,
1488 					   p2p_wildcard);
1489 #ifdef CONFIG_WPS_UPNP
1490 		/* FIX: what exactly should be included in the WLANEvent?
1491 		 * WPS attributes? Full ProbeReq frame? */
1492 		if (!p2p_wildcard)
1493 			upnp_wps_device_send_wlan_event(
1494 				hapd->wps_upnp, addr,
1495 				UPNP_WPS_WLANEVENT_TYPE_PROBE, wps_ie);
1496 #endif /* CONFIG_WPS_UPNP */
1497 	}
1498 
1499 	wpabuf_free(wps_ie);
1500 
1501 	return 0;
1502 }
1503 
1504 
1505 #ifdef CONFIG_WPS_UPNP
1506 
hostapd_rx_req_put_wlan_response(void * priv,enum upnp_wps_wlanevent_type ev_type,const u8 * mac_addr,const struct wpabuf * msg,enum wps_msg_type msg_type)1507 static int hostapd_rx_req_put_wlan_response(
1508 	void *priv, enum upnp_wps_wlanevent_type ev_type,
1509 	const u8 *mac_addr, const struct wpabuf *msg,
1510 	enum wps_msg_type msg_type)
1511 {
1512 	struct hostapd_data *hapd = priv;
1513 	struct sta_info *sta;
1514 	struct upnp_pending_message *p;
1515 
1516 	wpa_printf(MSG_DEBUG, "WPS UPnP: PutWLANResponse ev_type=%d mac_addr="
1517 		   MACSTR, ev_type, MAC2STR(mac_addr));
1518 	wpa_hexdump(MSG_MSGDUMP, "WPS UPnP: PutWLANResponse NewMessage",
1519 		    wpabuf_head(msg), wpabuf_len(msg));
1520 	if (ev_type != UPNP_WPS_WLANEVENT_TYPE_EAP) {
1521 		wpa_printf(MSG_DEBUG, "WPS UPnP: Ignored unexpected "
1522 			   "PutWLANResponse WLANEventType %d", ev_type);
1523 		return -1;
1524 	}
1525 
1526 	/*
1527 	 * EAP response to ongoing to WPS Registration. Send it to EAP-WSC
1528 	 * server implementation for delivery to the peer.
1529 	 */
1530 
1531 	sta = ap_get_sta(hapd, mac_addr);
1532 #ifndef CONFIG_WPS_STRICT
1533 	if (!sta) {
1534 		/*
1535 		 * Workaround - Intel wsccmd uses bogus NewWLANEventMAC:
1536 		 * Pick STA that is in an ongoing WPS registration without
1537 		 * checking the MAC address.
1538 		 */
1539 		wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found based "
1540 			   "on NewWLANEventMAC; try wildcard match");
1541 		for (sta = hapd->sta_list; sta; sta = sta->next) {
1542 			if (sta->eapol_sm && (sta->flags & WLAN_STA_WPS))
1543 				break;
1544 		}
1545 	}
1546 #endif /* CONFIG_WPS_STRICT */
1547 
1548 	if (!sta || !(sta->flags & WLAN_STA_WPS)) {
1549 		wpa_printf(MSG_DEBUG, "WPS UPnP: No matching STA found");
1550 		return 0;
1551 	}
1552 
1553 	if (!sta->eapol_sm) {
1554 		/*
1555 		 * This can happen, e.g., if an ER sends an extra message after
1556 		 * the station has disassociated (but not fully
1557 		 * deauthenticated).
1558 		 */
1559 		wpa_printf(MSG_DEBUG, "WPS UPnP: Matching STA did not have EAPOL state machine initialized");
1560 		return 0;
1561 	}
1562 
1563 	p = os_zalloc(sizeof(*p));
1564 	if (p == NULL)
1565 		return -1;
1566 	os_memcpy(p->addr, sta->addr, ETH_ALEN);
1567 	p->msg = wpabuf_dup(msg);
1568 	p->type = msg_type;
1569 	p->next = hapd->wps->upnp_msgs;
1570 	hapd->wps->upnp_msgs = p;
1571 
1572 	return eapol_auth_eap_pending_cb(sta->eapol_sm, sta->eapol_sm->eap);
1573 }
1574 
1575 
hostapd_wps_upnp_init(struct hostapd_data * hapd,struct wps_context * wps)1576 static int hostapd_wps_upnp_init(struct hostapd_data *hapd,
1577 				 struct wps_context *wps)
1578 {
1579 	struct upnp_wps_device_ctx *ctx;
1580 
1581 	if (!hapd->conf->upnp_iface)
1582 		return 0;
1583 	ctx = os_zalloc(sizeof(*ctx));
1584 	if (ctx == NULL)
1585 		return -1;
1586 
1587 	ctx->rx_req_put_wlan_response = hostapd_rx_req_put_wlan_response;
1588 	if (hapd->conf->ap_pin)
1589 		ctx->ap_pin = os_strdup(hapd->conf->ap_pin);
1590 
1591 	hapd->wps_upnp = upnp_wps_device_init(ctx, wps, hapd,
1592 					      hapd->conf->upnp_iface);
1593 	if (hapd->wps_upnp == NULL)
1594 		return -1;
1595 	wps->wps_upnp = hapd->wps_upnp;
1596 
1597 	return 0;
1598 }
1599 
1600 
hostapd_wps_upnp_deinit(struct hostapd_data * hapd)1601 static void hostapd_wps_upnp_deinit(struct hostapd_data *hapd)
1602 {
1603 	upnp_wps_device_deinit(hapd->wps_upnp, hapd);
1604 }
1605 
1606 #endif /* CONFIG_WPS_UPNP */
1607 
1608 
hostapd_wps_get_mib_sta(struct hostapd_data * hapd,const u8 * addr,char * buf,size_t buflen)1609 int hostapd_wps_get_mib_sta(struct hostapd_data *hapd, const u8 *addr,
1610 			    char *buf, size_t buflen)
1611 {
1612 	if (hapd->wps == NULL)
1613 		return 0;
1614 	return wps_registrar_get_info(hapd->wps->registrar, addr, buf, buflen);
1615 }
1616 
1617 
hostapd_wps_ap_pin_timeout(void * eloop_data,void * user_ctx)1618 static void hostapd_wps_ap_pin_timeout(void *eloop_data, void *user_ctx)
1619 {
1620 	struct hostapd_data *hapd = eloop_data;
1621 	wpa_printf(MSG_DEBUG, "WPS: AP PIN timed out");
1622 	hostapd_wps_ap_pin_disable(hapd);
1623 	wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_PIN_DISABLED);
1624 }
1625 
1626 
hostapd_wps_ap_pin_enable(struct hostapd_data * hapd,int timeout)1627 static void hostapd_wps_ap_pin_enable(struct hostapd_data *hapd, int timeout)
1628 {
1629 	wpa_printf(MSG_DEBUG, "WPS: Enabling AP PIN (timeout=%d)", timeout);
1630 	hapd->ap_pin_failures = 0;
1631 	hapd->ap_pin_failures_consecutive = 0;
1632 	hapd->conf->ap_setup_locked = 0;
1633 	if (hapd->wps->ap_setup_locked) {
1634 		wpa_msg(hapd->msg_ctx, MSG_INFO, WPS_EVENT_AP_SETUP_UNLOCKED);
1635 		hapd->wps->ap_setup_locked = 0;
1636 		wps_registrar_update_ie(hapd->wps->registrar);
1637 	}
1638 	eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1639 	if (timeout > 0)
1640 		eloop_register_timeout(timeout, 0,
1641 				       hostapd_wps_ap_pin_timeout, hapd, NULL);
1642 }
1643 
1644 
wps_ap_pin_disable(struct hostapd_data * hapd,void * ctx)1645 static int wps_ap_pin_disable(struct hostapd_data *hapd, void *ctx)
1646 {
1647 	os_free(hapd->conf->ap_pin);
1648 	hapd->conf->ap_pin = NULL;
1649 #ifdef CONFIG_WPS_UPNP
1650 	upnp_wps_set_ap_pin(hapd->wps_upnp, NULL);
1651 #endif /* CONFIG_WPS_UPNP */
1652 	eloop_cancel_timeout(hostapd_wps_ap_pin_timeout, hapd, NULL);
1653 	return 0;
1654 }
1655 
1656 
hostapd_wps_ap_pin_disable(struct hostapd_data * hapd)1657 void hostapd_wps_ap_pin_disable(struct hostapd_data *hapd)
1658 {
1659 	wpa_printf(MSG_DEBUG, "WPS: Disabling AP PIN");
1660 	hostapd_wps_for_each(hapd, wps_ap_pin_disable, NULL);
1661 }
1662 
1663 
1664 struct wps_ap_pin_data {
1665 	char pin_txt[9];
1666 	int timeout;
1667 };
1668 
1669 
wps_ap_pin_set(struct hostapd_data * hapd,void * ctx)1670 static int wps_ap_pin_set(struct hostapd_data *hapd, void *ctx)
1671 {
1672 	struct wps_ap_pin_data *data = ctx;
1673 
1674 	if (!hapd->wps)
1675 		return 0;
1676 
1677 	os_free(hapd->conf->ap_pin);
1678 	hapd->conf->ap_pin = os_strdup(data->pin_txt);
1679 #ifdef CONFIG_WPS_UPNP
1680 	upnp_wps_set_ap_pin(hapd->wps_upnp, data->pin_txt);
1681 #endif /* CONFIG_WPS_UPNP */
1682 	hostapd_wps_ap_pin_enable(hapd, data->timeout);
1683 	return 0;
1684 }
1685 
1686 
hostapd_wps_ap_pin_random(struct hostapd_data * hapd,int timeout)1687 const char * hostapd_wps_ap_pin_random(struct hostapd_data *hapd, int timeout)
1688 {
1689 	unsigned int pin;
1690 	struct wps_ap_pin_data data;
1691 
1692 	if (wps_generate_pin(&pin) < 0)
1693 		return NULL;
1694 	os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%08u", pin);
1695 	data.timeout = timeout;
1696 	hostapd_wps_for_each(hapd, wps_ap_pin_set, &data);
1697 	return hapd->conf->ap_pin;
1698 }
1699 
1700 
hostapd_wps_ap_pin_get(struct hostapd_data * hapd)1701 const char * hostapd_wps_ap_pin_get(struct hostapd_data *hapd)
1702 {
1703 	return hapd->conf->ap_pin;
1704 }
1705 
1706 
hostapd_wps_ap_pin_set(struct hostapd_data * hapd,const char * pin,int timeout)1707 int hostapd_wps_ap_pin_set(struct hostapd_data *hapd, const char *pin,
1708 			   int timeout)
1709 {
1710 	struct wps_ap_pin_data data;
1711 	int ret;
1712 
1713 	ret = os_snprintf(data.pin_txt, sizeof(data.pin_txt), "%s", pin);
1714 	if (os_snprintf_error(sizeof(data.pin_txt), ret))
1715 		return -1;
1716 	data.timeout = timeout;
1717 	return hostapd_wps_for_each(hapd, wps_ap_pin_set, &data);
1718 }
1719 
1720 
wps_update_ie(struct hostapd_data * hapd,void * ctx)1721 static int wps_update_ie(struct hostapd_data *hapd, void *ctx)
1722 {
1723 	if (hapd->wps)
1724 		wps_registrar_update_ie(hapd->wps->registrar);
1725 	return 0;
1726 }
1727 
1728 
hostapd_wps_update_ie(struct hostapd_data * hapd)1729 void hostapd_wps_update_ie(struct hostapd_data *hapd)
1730 {
1731 	hostapd_wps_for_each(hapd, wps_update_ie, NULL);
1732 }
1733 
1734 
hostapd_wps_config_ap(struct hostapd_data * hapd,const char * ssid,const char * auth,const char * encr,const char * key)1735 int hostapd_wps_config_ap(struct hostapd_data *hapd, const char *ssid,
1736 			  const char *auth, const char *encr, const char *key)
1737 {
1738 	struct wps_credential cred;
1739 	size_t len;
1740 
1741 	os_memset(&cred, 0, sizeof(cred));
1742 
1743 	len = os_strlen(ssid);
1744 	if ((len & 1) || len > 2 * sizeof(cred.ssid) ||
1745 	    hexstr2bin(ssid, cred.ssid, len / 2))
1746 		return -1;
1747 	cred.ssid_len = len / 2;
1748 
1749 	if (os_strncmp(auth, "OPEN", 4) == 0)
1750 		cred.auth_type = WPS_AUTH_OPEN;
1751 	else if (os_strncmp(auth, "WPAPSK", 6) == 0)
1752 		cred.auth_type = WPS_AUTH_WPAPSK;
1753 	else if (os_strncmp(auth, "WPA2PSK", 7) == 0)
1754 		cred.auth_type = WPS_AUTH_WPA2PSK;
1755 	else
1756 		return -1;
1757 
1758 	if (encr) {
1759 		if (os_strncmp(encr, "NONE", 4) == 0)
1760 			cred.encr_type = WPS_ENCR_NONE;
1761 		else if (os_strncmp(encr, "TKIP", 4) == 0)
1762 			cred.encr_type = WPS_ENCR_TKIP;
1763 		else if (os_strncmp(encr, "CCMP", 4) == 0)
1764 			cred.encr_type = WPS_ENCR_AES;
1765 		else
1766 			return -1;
1767 	} else
1768 		cred.encr_type = WPS_ENCR_NONE;
1769 
1770 	if (key) {
1771 		len = os_strlen(key);
1772 		if ((len & 1) || len > 2 * sizeof(cred.key) ||
1773 		    hexstr2bin(key, cred.key, len / 2))
1774 			return -1;
1775 		cred.key_len = len / 2;
1776 	}
1777 
1778 	return wps_registrar_config_ap(hapd->wps->registrar, &cred);
1779 }
1780 
1781 
1782 #ifdef CONFIG_WPS_NFC
1783 
1784 struct wps_nfc_password_token_data {
1785 	const u8 *oob_dev_pw;
1786 	size_t oob_dev_pw_len;
1787 	int added;
1788 };
1789 
1790 
wps_add_nfc_password_token(struct hostapd_data * hapd,void * ctx)1791 static int wps_add_nfc_password_token(struct hostapd_data *hapd, void *ctx)
1792 {
1793 	struct wps_nfc_password_token_data *data = ctx;
1794 	int ret;
1795 
1796 	if (hapd->wps == NULL)
1797 		return 0;
1798 	ret = wps_registrar_add_nfc_password_token(hapd->wps->registrar,
1799 						   data->oob_dev_pw,
1800 						   data->oob_dev_pw_len);
1801 	if (ret == 0)
1802 		data->added++;
1803 	return ret;
1804 }
1805 
1806 
hostapd_wps_add_nfc_password_token(struct hostapd_data * hapd,struct wps_parse_attr * attr)1807 static int hostapd_wps_add_nfc_password_token(struct hostapd_data *hapd,
1808 					      struct wps_parse_attr *attr)
1809 {
1810 	struct wps_nfc_password_token_data data;
1811 
1812 	data.oob_dev_pw = attr->oob_dev_password;
1813 	data.oob_dev_pw_len = attr->oob_dev_password_len;
1814 	data.added = 0;
1815 	if (hostapd_wps_for_each(hapd, wps_add_nfc_password_token, &data) < 0)
1816 		return -1;
1817 	return data.added ? 0 : -1;
1818 }
1819 
1820 
hostapd_wps_nfc_tag_process(struct hostapd_data * hapd,const struct wpabuf * wps)1821 static int hostapd_wps_nfc_tag_process(struct hostapd_data *hapd,
1822 				       const struct wpabuf *wps)
1823 {
1824 	struct wps_parse_attr attr;
1825 
1826 	wpa_hexdump_buf(MSG_DEBUG, "WPS: Received NFC tag payload", wps);
1827 
1828 	if (wps_parse_msg(wps, &attr)) {
1829 		wpa_printf(MSG_DEBUG, "WPS: Ignore invalid data from NFC tag");
1830 		return -1;
1831 	}
1832 
1833 	if (attr.oob_dev_password)
1834 		return hostapd_wps_add_nfc_password_token(hapd, &attr);
1835 
1836 	wpa_printf(MSG_DEBUG, "WPS: Ignore unrecognized NFC tag");
1837 	return -1;
1838 }
1839 
1840 
hostapd_wps_nfc_tag_read(struct hostapd_data * hapd,const struct wpabuf * data)1841 int hostapd_wps_nfc_tag_read(struct hostapd_data *hapd,
1842 			     const struct wpabuf *data)
1843 {
1844 	const struct wpabuf *wps = data;
1845 	struct wpabuf *tmp = NULL;
1846 	int ret;
1847 
1848 	if (wpabuf_len(data) < 4)
1849 		return -1;
1850 
1851 	if (*wpabuf_head_u8(data) != 0x10) {
1852 		/* Assume this contains full NDEF record */
1853 		tmp = ndef_parse_wifi(data);
1854 		if (tmp == NULL) {
1855 			wpa_printf(MSG_DEBUG, "WPS: Could not parse NDEF");
1856 			return -1;
1857 		}
1858 		wps = tmp;
1859 	}
1860 
1861 	ret = hostapd_wps_nfc_tag_process(hapd, wps);
1862 	wpabuf_free(tmp);
1863 	return ret;
1864 }
1865 
1866 
hostapd_wps_nfc_config_token(struct hostapd_data * hapd,int ndef)1867 struct wpabuf * hostapd_wps_nfc_config_token(struct hostapd_data *hapd,
1868 					     int ndef)
1869 {
1870 	struct wpabuf *ret;
1871 
1872 	if (hapd->wps == NULL)
1873 		return NULL;
1874 
1875 	ret = wps_get_oob_cred(hapd->wps, hostapd_wps_rf_band_cb(hapd),
1876 			       hapd->iconf->channel);
1877 	if (ndef && ret) {
1878 		struct wpabuf *tmp;
1879 		tmp = ndef_build_wifi(ret);
1880 		wpabuf_free(ret);
1881 		if (tmp == NULL)
1882 			return NULL;
1883 		ret = tmp;
1884 	}
1885 
1886 	return ret;
1887 }
1888 
1889 
hostapd_wps_nfc_hs_cr(struct hostapd_data * hapd,int ndef)1890 struct wpabuf * hostapd_wps_nfc_hs_cr(struct hostapd_data *hapd, int ndef)
1891 {
1892 	struct wpabuf *ret;
1893 
1894 	if (hapd->wps == NULL)
1895 		return NULL;
1896 
1897 	if (hapd->conf->wps_nfc_dh_pubkey == NULL) {
1898 		struct wps_context *wps = hapd->wps;
1899 		if (wps_nfc_gen_dh(&hapd->conf->wps_nfc_dh_pubkey,
1900 				   &hapd->conf->wps_nfc_dh_privkey) < 0)
1901 			return NULL;
1902 		hostapd_wps_nfc_clear(wps);
1903 		wps->ap_nfc_dev_pw_id = DEV_PW_NFC_CONNECTION_HANDOVER;
1904 		wps->ap_nfc_dh_pubkey =
1905 			wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey);
1906 		wps->ap_nfc_dh_privkey =
1907 			wpabuf_dup(hapd->conf->wps_nfc_dh_privkey);
1908 		if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey) {
1909 			hostapd_wps_nfc_clear(wps);
1910 			return NULL;
1911 		}
1912 	}
1913 
1914 	ret = wps_build_nfc_handover_sel(hapd->wps,
1915 					 hapd->conf->wps_nfc_dh_pubkey,
1916 					 hapd->own_addr, hapd->iface->freq);
1917 
1918 	if (ndef && ret) {
1919 		struct wpabuf *tmp;
1920 		tmp = ndef_build_wifi(ret);
1921 		wpabuf_free(ret);
1922 		if (tmp == NULL)
1923 			return NULL;
1924 		ret = tmp;
1925 	}
1926 
1927 	return ret;
1928 }
1929 
1930 
hostapd_wps_nfc_report_handover(struct hostapd_data * hapd,const struct wpabuf * req,const struct wpabuf * sel)1931 int hostapd_wps_nfc_report_handover(struct hostapd_data *hapd,
1932 				    const struct wpabuf *req,
1933 				    const struct wpabuf *sel)
1934 {
1935 	struct wpabuf *wps;
1936 	int ret = -1;
1937 	u16 wsc_len;
1938 	const u8 *pos;
1939 	struct wpabuf msg;
1940 	struct wps_parse_attr attr;
1941 	u16 dev_pw_id;
1942 
1943 	/*
1944 	 * Enrollee/station is always initiator of the NFC connection handover,
1945 	 * so use the request message here to find Enrollee public key hash.
1946 	 */
1947 	wps = ndef_parse_wifi(req);
1948 	if (wps == NULL)
1949 		return -1;
1950 	wpa_printf(MSG_DEBUG, "WPS: Received application/vnd.wfa.wsc "
1951 		   "payload from NFC connection handover");
1952 	wpa_hexdump_buf(MSG_DEBUG, "WPS: NFC payload", wps);
1953 	if (wpabuf_len(wps) < 2) {
1954 		wpa_printf(MSG_DEBUG, "WPS: Too short Wi-Fi Handover Request "
1955 			   "Message");
1956 		goto out;
1957 	}
1958 	pos = wpabuf_head(wps);
1959 	wsc_len = WPA_GET_BE16(pos);
1960 	if (wsc_len > wpabuf_len(wps) - 2) {
1961 		wpa_printf(MSG_DEBUG, "WPS: Invalid WSC attribute length (%u) "
1962 			   "in rt Wi-Fi Handover Request Message", wsc_len);
1963 		goto out;
1964 	}
1965 	pos += 2;
1966 
1967 	wpa_hexdump(MSG_DEBUG,
1968 		    "WPS: WSC attributes in Wi-Fi Handover Request Message",
1969 		    pos, wsc_len);
1970 	if (wsc_len < wpabuf_len(wps) - 2) {
1971 		wpa_hexdump(MSG_DEBUG,
1972 			    "WPS: Ignore extra data after WSC attributes",
1973 			    pos + wsc_len, wpabuf_len(wps) - 2 - wsc_len);
1974 	}
1975 
1976 	wpabuf_set(&msg, pos, wsc_len);
1977 	ret = wps_parse_msg(&msg, &attr);
1978 	if (ret < 0) {
1979 		wpa_printf(MSG_DEBUG, "WPS: Could not parse WSC attributes in "
1980 			   "Wi-Fi Handover Request Message");
1981 		goto out;
1982 	}
1983 
1984 	if (attr.oob_dev_password == NULL ||
1985 	    attr.oob_dev_password_len < WPS_OOB_PUBKEY_HASH_LEN + 2) {
1986 		wpa_printf(MSG_DEBUG, "WPS: No Out-of-Band Device Password "
1987 			   "included in Wi-Fi Handover Request Message");
1988 		ret = -1;
1989 		goto out;
1990 	}
1991 
1992 	if (attr.uuid_e == NULL) {
1993 		wpa_printf(MSG_DEBUG, "WPS: No UUID-E included in Wi-Fi "
1994 			   "Handover Request Message");
1995 		ret = -1;
1996 		goto out;
1997 	}
1998 
1999 	wpa_hexdump(MSG_DEBUG, "WPS: UUID-E", attr.uuid_e, WPS_UUID_LEN);
2000 
2001 	wpa_hexdump(MSG_DEBUG, "WPS: Out-of-Band Device Password",
2002 		    attr.oob_dev_password, attr.oob_dev_password_len);
2003 	dev_pw_id = WPA_GET_BE16(attr.oob_dev_password +
2004 				 WPS_OOB_PUBKEY_HASH_LEN);
2005 	if (dev_pw_id != DEV_PW_NFC_CONNECTION_HANDOVER) {
2006 		wpa_printf(MSG_DEBUG, "WPS: Unexpected OOB Device Password ID "
2007 			   "%u in Wi-Fi Handover Request Message", dev_pw_id);
2008 		ret = -1;
2009 		goto out;
2010 	}
2011 	wpa_hexdump(MSG_DEBUG, "WPS: Enrollee Public Key hash",
2012 		    attr.oob_dev_password, WPS_OOB_PUBKEY_HASH_LEN);
2013 
2014 	ret = wps_registrar_add_nfc_pw_token(hapd->wps->registrar,
2015 					     attr.oob_dev_password,
2016 					     DEV_PW_NFC_CONNECTION_HANDOVER,
2017 					     NULL, 0, 1);
2018 
2019 out:
2020 	wpabuf_free(wps);
2021 	return ret;
2022 }
2023 
2024 
hostapd_wps_nfc_token_gen(struct hostapd_data * hapd,int ndef)2025 struct wpabuf * hostapd_wps_nfc_token_gen(struct hostapd_data *hapd, int ndef)
2026 {
2027 	if (hapd->conf->wps_nfc_pw_from_config) {
2028 		return wps_nfc_token_build(ndef,
2029 					   hapd->conf->wps_nfc_dev_pw_id,
2030 					   hapd->conf->wps_nfc_dh_pubkey,
2031 					   hapd->conf->wps_nfc_dev_pw);
2032 	}
2033 
2034 	return wps_nfc_token_gen(ndef, &hapd->conf->wps_nfc_dev_pw_id,
2035 				 &hapd->conf->wps_nfc_dh_pubkey,
2036 				 &hapd->conf->wps_nfc_dh_privkey,
2037 				 &hapd->conf->wps_nfc_dev_pw);
2038 }
2039 
2040 
hostapd_wps_nfc_token_enable(struct hostapd_data * hapd)2041 int hostapd_wps_nfc_token_enable(struct hostapd_data *hapd)
2042 {
2043 	struct wps_context *wps = hapd->wps;
2044 	struct wpabuf *pw;
2045 
2046 	if (wps == NULL)
2047 		return -1;
2048 
2049 	if (!hapd->conf->wps_nfc_dh_pubkey ||
2050 	    !hapd->conf->wps_nfc_dh_privkey ||
2051 	    !hapd->conf->wps_nfc_dev_pw ||
2052 	    !hapd->conf->wps_nfc_dev_pw_id)
2053 		return -1;
2054 
2055 	hostapd_wps_nfc_clear(wps);
2056 	wpa_printf(MSG_DEBUG,
2057 		   "WPS: Enable NFC Tag (Dev Pw Id %u) for AP interface %s (context %p)",
2058 		   hapd->conf->wps_nfc_dev_pw_id, hapd->conf->iface, wps);
2059 	wps->ap_nfc_dev_pw_id = hapd->conf->wps_nfc_dev_pw_id;
2060 	wps->ap_nfc_dh_pubkey = wpabuf_dup(hapd->conf->wps_nfc_dh_pubkey);
2061 	wps->ap_nfc_dh_privkey = wpabuf_dup(hapd->conf->wps_nfc_dh_privkey);
2062 	pw = hapd->conf->wps_nfc_dev_pw;
2063 	wps->ap_nfc_dev_pw = wpabuf_alloc(
2064 		wpabuf_len(pw) * 2 + 1);
2065 	if (wps->ap_nfc_dev_pw) {
2066 		wpa_snprintf_hex_uppercase(
2067 			(char *) wpabuf_put(wps->ap_nfc_dev_pw,
2068 					    wpabuf_len(pw) * 2),
2069 			wpabuf_len(pw) * 2 + 1,
2070 			wpabuf_head(pw), wpabuf_len(pw));
2071 	}
2072 
2073 	if (!wps->ap_nfc_dh_pubkey || !wps->ap_nfc_dh_privkey ||
2074 	    !wps->ap_nfc_dev_pw) {
2075 		hostapd_wps_nfc_clear(wps);
2076 		return -1;
2077 	}
2078 
2079 	return 0;
2080 }
2081 
2082 
hostapd_wps_nfc_token_disable(struct hostapd_data * hapd)2083 void hostapd_wps_nfc_token_disable(struct hostapd_data *hapd)
2084 {
2085 	wpa_printf(MSG_DEBUG, "WPS: Disable NFC token for AP interface %s",
2086 		   hapd->conf->iface);
2087 	hostapd_wps_nfc_clear(hapd->wps);
2088 }
2089 
2090 #endif /* CONFIG_WPS_NFC */
2091